Privacy Policy

Final Castle, called Final Kastle on Google Play and the App Store, by Cappie Studios.

Effective October 19, 2026.

The short version

Offline play needs no account and sends nothing that identifies you. Online play stores only what it needs: your username, your sign in links, your friends and blocks, and player reports. We show no ads, add no tracking or analytics of our own, and never sell or share your information for marketing. Epic Online Services runs sign in and online play for the game; the data its software collects to do that, and for analytics and diagnostics of the online service, is explained below.

Playing offline

When you choose Play Offline, your castle, progress and settings are saved on your device only. The game still downloads the current game rules (numbers like wave sizes) from our server; that request carries no personal information. The Epic Online Services software in the game may also send anonymous diagnostics (see below).

Signing in for online play

You only sign in when you choose PLAY or open Social. You sign in with an account you already have:

• an Epic Games account on PC;
• a Google account on Android;
• Sign in with Apple on iPhone and iPad.

The sign in goes through Epic Online Services, which checks it and gives our server an account identifier for you. We never see or store your password, and our server does not store your email address.

What our server keeps

Our server at cappietarot.com keeps:

• the Final Castle username you choose, and when you set or changed it;
• the identifiers of the sign in accounts you link, your Epic Online Services player identifier, and which platform you play on;
• when your account was created and when you last played online;
• your friends list, friend requests and blocks;
• player reports (see Reports below);
• short lived sign in tokens, stored only in hashed form, and match passes that let you join a castle;
• your Weekly Champions data: your weekly scores (enemies, bosses, cleared waves and rescued prisoners), the badges you earned and the gifts you were granted, kept in the weekly archives with your username;
• if you sign in with Apple: a Sign in with Apple refresh token, used only to end your Apple sign in with Apple when you delete your account or unlink Apple. If Apple is temporarily unavailable, we retain the token in a retry queue without your account identifier until Apple confirms revocation, then erase it.
• while you host a castle open to everyone: its listing (the Epic session id of the castle, the game version, the wave, the player count and capacity, when it opened and was last updated). Players signed in to the game see that listing with your username in the lobby's server list, the way friends see each other online; the open castles page at cappietarot.com/finalcastle/matches/ shows it without your name or any identifier of you.

To stop abuse, the server counts requests for a few minutes at a time using a one way hash that includes your IP address. The address itself is not stored in our database. Like any website, our web host may keep standard access logs (IP address, time, page requested) for a short time for security.

In an online castle, other players see your username, your character and what you do in the game. There is no text or voice chat. Friends also see whether you are online and which platform you play on, and their game receives your Epic Online Services player identifier so it can join you. When you join a castle, the host's game checks your match pass with our server and receives your username, account identifier and platform.

Epic Online Services and the game engine

Epic Online Services (EOS), from Epic Games, runs sign in, matchmaking and online sessions for Final Castle. The EOS software inside the game declares that it collects:

• a user identifier;
• your name and email address from the account you sign in with (Epic Games, Google or Apple; with Sign in with Apple this may be a private relay address). EOS receives these; our server never does;
• gameplay content from online sessions;
• product interaction, meaning how the game's online features are used;
• performance and diagnostic data.

EOS uses this to provide sign in and online play, and for analytics and diagnostics of the online service. Epic's privacy policy also applies. Unreal Engine, which the game is built with, can also record crash and performance diagnostics. None of this is used for ads or to track you across other companies' apps and websites.

Google, Apple and the stores

Google sign in is covered by Google's privacy policy and Sign in with Apple by Apple's privacy policy. With Sign in with Apple you may hide your email address; our server does not receive it either way.

Epic, Google and Apple receive only what is needed to sign you in and run online play, and protect it at least as well as this policy describes.

If you install the game from Google Play or the App Store, the store handles the download and your store account under its own policy. The stores send us no personal information about you. They may show us combined numbers, such as installs and crash rates, that do not identify you.

Reports

When you report a player, our server keeps who sent the report, which player it is about, that player's name, the reason and the time. The reported player is not told who reported them. We use reports only to check names and behaviour against the player rules.

Reports are kept for one year and then deleted. If the reported player deletes their account, reports about them are deleted with it. If you delete your account, reports you sent stay until their year ends, but without anything that links them to you.

How long we keep it

• Username, linked sign ins, platform, account dates, friends, friend requests and blocks: until you delete your account. Unlinking a sign in removes it right away.
• Sign in tokens: 12 hours. Match passes: 10 minutes. Link codes: 5 minutes. Expired ones are removed automatically.
• Abuse counters (hashed IP): about two hours.
• Reports: one year.
• Castle listings: removed when the castle closes, no longer shown after 90 seconds without an update, deleted after one hour.
• Emails you send us: as long as we need to answer you. Ask and we delete them.
• Saves on your device: until you uninstall the game.
• Data held by Epic, Google or Apple: under their own policies.

Security

The game talks to our server and to Epic Online Services only over encrypted connections (HTTPS). We never receive passwords. Sign in tokens are stored only as one way hashes, player identifiers are random, and the database is kept outside the public part of the web server. Only the developer can use the server's admin functions. No system is perfectly safe; if we learn that your information was exposed, we will say so on this page.

Deleting your information

In the game, open Social, then Privacy, and choose Delete account. The game asks twice (Continue, then Delete forever). Then your username, every linked sign in, your friends, friend requests, blocks, sessions and weekly rankings data are removed from our server right away, and a Sign in with Apple is revoked with Apple. For safety, a sign in linked in the last 7 days cannot delete the account; use the sign in you played with first, or try again later.

If you cannot open the game, use the account deletion page or email us at cappietarot@gmail.com. Uninstalling the game removes everything saved on your device. You can also email us to ask what our server holds about you.

Children

Final Castle is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has created an online account, email us and we will delete it.

Changes

If this policy changes, we will update this page and its date. Questions: cappietarot@gmail.com